Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 24 Sep 2002 20:00:07 +0200

James, 
See also Mohan's email

  > Right, that's what I said. Ingress filtering does not stop 
  > someone spoofing a
  > legitimate address, 

=> By legitimising another address that belongs
to another subnet, we are breaking the whole point
behind ingress filtering. This is what's new here.

nor spoofing an
  > address with a legitmate prefix. So, in that sense, it 
  > won't stop an attacker
  > from using an address X:Y, where Y is the host identifier 
  > for a legitimate node
  > on the link using the prefix _for which the router is 
  > performing ingress
  > filtering_.
  > 
  > It's the same way with K. Anybody can spoof K's address, 
  > but they can't spoof
  > another address with H as a prefix.
  > 
  > Solving this problem is what SEND is about.

=> I don't think SEND is about solving spoofed
prefixes. I don't know how to explain my point
any better :(. The crus of the point is that a
topologically incorrect prefix/address is made
legitimate and that allows attackers to launch
atacks without having their real loctions detected. 
This is what ingress filtering stops and we're 
breaking that in FMIPv6. 

Hesham

---

From: Rajeev Koodli <[email-masked]>
Date: Tue, 24 Sep 2002 11:52:59 -0700

Hello Hesham, James,

> This is what ingress filtering stops and we're

I don't think we are breaking it any more than
allowing HoA and reverse tunneling
from FA in MIPv4. Are we ?

I think it is harder to spoof an arbitrary combination
of off-link prefix and iid.
Here is what a malicious node needs to do I think.

- spoof the off-link prefix. How ? by monitoring the traffic ?
   How is prefix length determined ? The off-link prefix
   is never advertised on the new router's link. If the attacker
   moved from the link where the off-link prefix is valid,
   then he would know the off-link prefix.
- spoof the MAC address. How ? Through ND.
- keep looking for the "window" to open. That is, guess when
   the new router would allow traffic with previous CoA.
- send packets with the spoofed address

This is hard work with questionable incentives, especially if
the tunnel lifetime is kept short. So, by recommending the
tunnel be open only until the MN becomes a MIPv6 end-point,
we could significantly reduce any vulnerability: the window of time is
short, and the potential attacker has to keep looking for the
window to open. This seems like a balance to me.

And, to trace the source: I guess we should be able to reach the
previous AR right ? Since it has engaged in HI/HAck with new
AR, it knows the location where the previous CoA could be
active (until the lifetime of the tunnel). So, we could trace it.

-Rajeev

---

From: "James Kempf" <[email-masked]>
Date: Tue, 24 Sep 2002 20:53:58 -0700

> This is what ingress filtering stops and we're 

Give me an example.

            jak